FEBRUARY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT A NEW TREND IN Are your networks secure? VIRUS WRITING? Following in the footsteps 3 NEWS of W32/Bugbear.A, VB2004 call for papers W32/Mimail.I and .J took Divine intervention the concern of identity theft Waiting, reflecting and removing to another level, producing a plausible-looking popup and web page and asking questions that are favoured security checks of many 3 VIRUS PREVALENCE TABLE banks. Stuart Taylor asks: is there a criminal element entering virus writing? 4 FEATURE page 11 Outbreak response times: putting AV to the test TESTING TIMES It’s not just a product’s ability to detect malware 7 TUTORIAL that is of vital importance to the user, but the speed Mission impossible: the Messenger with which the developer produces an update in and others outbreak situations. Andreas Marx puts AV response times to the test. 11 OPINION page 4 Misguided or malevolent? New trends in virus writing COMPARATIVE REVIEW Matt Ham lines up the AV products for 12 COMPARATIVE REVIEW Windows NT. page 12 Windows NT 4.0 20 END NOTES & NEWS This month: Anti-spam news and events, Habeas delivering the goods, ASRG summary. ISSN 0956-9979 COMMENT ‘Until now, most who are not located in the same office, who may be travelling on business or may be working from home. business use of Managers from any location can respond to instant instant messaging messages with quick decisions. Presence-awareness allows each user to see the online status and availability has been of the of other colleagues on the system. Furthermore, IM “stealth” variety.’ frees users from the comparatively slow alternative of Joe Licari email, which may be bogged down by spam, delays Sybari Software, USA and restrictions. In spite of these benefits, many organizations have previously rejected the use of IM due to compliance ARE YOUR NETWORKS requirements or justifiable concerns about security and SECURE? policy breaches that might result from its unmanaged deployment. Other organizations simply allowed rogue In December 2003, I attended the Emerging Technology IM clients to be used without any additional security, Showcase held in Scottsdale, Arizona. The event was monitoring or IT management. Clearly, these are not designed to help companies define new business permanent solutions. initiatives and select emerging technologies that help Network administrators now have to contend with a new them adapt to their markets more effectively and network access point for viruses and malicious code. profitably. At the conference I was prepared to present Those in charge of protecting the corporate infrastructure my views on emerging technologies. I was also prepared need to have a clear understanding of the security risks for a timely break from the burgeoning New York winter. presented by real-time communications. As an initial However, I wasn’t prepared for the high level of interest step, administrators are urged to perform a corporate and buzz surrounding instant messaging and presence- audit to determine which IM services may already be awareness in the enterprise. running on clients within their organizations. Time and Seemingly overnight, there had been a change in attitude resources must be allocated to standardize on an towards real-time collaboration and instant messaging enterprise solution that meets user demand while (IM) applications – which are now being viewed as instituting appropriate security and policy management. critical and effective communication vehicles for the As with email in the late 1990s, administrators may enterprise. CIOs and their IT groups are evaluating and choose to ignore the imminent virus vector and simply planning for the deployment of managed real-time rely on perimeter AV protection at the desktop. But, of collaboration applications in 2004. course, when virus attacks eventually discredited this Until now, most business use of IM has been of the strategy, organizations and AV vendors alike quickly ‘stealth’ variety – employees using public network demanded solutions for gateway and messaging servers. (consumer) IM clients on an informal basis without the As a result, today’s IT professionals require server-side approval or knowledge of their IT departments. So why solutions to protect against new malicious threats in their the recent business interest in IM? Instant messaging instant messaging environments. The provision of provides an easy way to communicate with colleagues anti-virus and content filtering protection on real-time collaboration servers is the most efficient way to scan all IM traffic for viruses, worms, IM Trojans and other malicious code. It is also the ideal location to filter and Editor: Helen Martin block messages and attachments containing Technical Consultant: Matt Ham objectionable content. Technical Editor: Morton Swimmer My break from New York’s winter weather conditions Consulting Editors: was all too fleeting. In contrast, the acceptance and Nick FitzGerald, Independent consultant, NZ growth of instant messaging and real-time collaboration Ian Whalley, IBM Research, USA in enterprise organizations appears to be long-lasting. By Richard Ford, Florida Institute of Technology, USA applying the prudent and diligent implementation of Edward Wilding, Data Genetics, UK server-based security solutions, we can ensure that this will be a safe and productive medium resulting in greater communication and efficiency in our organizations. 2 FEBRUARY 2004 VIRUS BULLETIN www.virusbtn.com NEWS VB2004: CALL FOR PAPERS Virus Bulletin is seeking Prevalence Table – December 2003 submissions from those wishing to present at VB2004, Virus Type Incidents Reports the Fourteenth Virus Bulletin International Conference, Win32/Opaserv File 5376 29.40% which will take place 29 September to 1 October 2004 at Win32/Mimail File 3606 19.72% the Fairmont Chicago, Illinois, USA. Abstracts of Win32/Dumaru File 2940 16.08% approximately 200 words must reach the Editor of Virus Win32/Swen File 1616 8.84% Bulletin ([email protected]) no later than 31 March 2004. For further details see http://www.virusbtn.com/. Win32/Dupator File 764 4.18% Win32/Bugbear File 709 3.88% Win32/Klez File 541 2.96% DIVINE INTERVENTION Win32/Yaha File 476 2.60% We all know how quickly time flies when we’re having fun, Win32/Sober File 475 2.60% or when there’s a deadline looming, but a recent news report on the Asian news website Channel NewsAsia Win32/Gibe File 397 2.17% (http://www.channelnewsasia.com/) had us rushing to Win32/Sobig File 382 2.09% double-check our calendars to make sure we hadn’t Win32/Frethem File 181 0.99% fast-forwarded to April 1st. Win32/SirCam File 114 0.62% The site reports that, last month, a number of Japanese IT Win95/Spaces File 83 0.45% businesses and computer vendors gathered, along with their Win32/Deborm File 59 0.32% computers, at the Kansa Myojin shrine in downtown Toyko to partake in Shinto purification rituals and receive Win32/Nachi File 54 0.30% blessings to protect against computer viruses and hackers. Win32/Spybot File 46 0.25% According to Channel NewsAsia, many people in Japan Win32/Magistr File 44 0.24% feel that anti-virus software and security measures alone Win32/Fizzer File 33 0.18% are simply not enough to protect against the increasing number of electronic threats, hence they are turning to Win32/Lovsan File 33 0.18% more ancient traditions to ward off these modern evils. Win32/Torvil File 33 0.18% We were relieved to learn that the spiritual rituals are being Win32/Pate File 24 0.13% used to supplement anti-virus and other security solutions, WelcomB Boot 21 0.11% rather than as an alternative. As figures quoted by the Win32/Gaobot File 21 0.11% Japanese National Police Agency suggest that the nation’s computer network currently sees a monthly average of Win32/Kriz File 21 0.11% 35,000 ‘cyber attacks’, we look forward to reading reports Win95/Lorez File 20 0.11% of the resultant decline in incidents. Who knows, there Win32/Holar File 17 0.09% may be a whole new VB conference stream for spiritual Win32/Parite File 17 0.09% anti-virus protection methods next year … Win32/Valla File 17 0.09% Win32/Funlove File 15 0.08% WAITING, REFLECTING AND REMOVING Redlof Script 12 0.07% While young Romanian virus author Dan Dumitru Ciobanu Win32/Randex File 12 0.07% awaited trial by a Romanian court last month for releasing a Others 137 0.75% variant of W32/Blaster that reportedly infected just 27 machines, Microsoft was reflecting on the success of its Total 18,286 100% removal tool for the original variant. The tool, the first of its kind to be provided by Microsoft, was released five months [1]The Prevalence Table includes a total of 137 reports across after the initial appearance of the worm, and was downloaded 53 further viruses. Readers are reminded that a complete listing is posted at http://www.virusbtn.com/Prevalence/. 1.4 million times (mainly automatically through Windows Update) during the first few hours of its availability. FEBRUARY 2004 3 VIRUS BULLETIN www.virusbtn.com FEATURE OUTBREAK RESPONSE TIMES: October 2003. At this time, we implemented automatic checking of the updates of only about ten anti-virus PUTTING AV TO THE TEST products, but we encountered several problems Andreas Marx straight away. AV-Test.org, Germany The script checks every five minutes for changes in the anti-virus update and program files on FTP and HTTP Most comparative reviews of anti-virus programs focus on servers. As an example, the updates for H+BEDV AntiVir the products’ worm and virus detection rates. But an are always stored at http://www.antivir.de/dateien/antivir/ important aspect of anti-virus products is often overlooked: fuse/fuse.zip.